skysight-inc/HackerNews huggingface dataset:
Exactly. When you go to provide your information to a website, you need to consider "what are all the possible outcomes of this?" We can't use the reputation of the providers of a service as a proxy and thus have zero information about what to expect. Since you almost never have the source code for the website you're giving your information to, using your logic, just never give your data out. Right?
> In his own responses, he says that he won't email the users!

If they're based almost anywhere in the US or EU, they might well have a legal obligation to notify at this point.

(I am not your lawyer, etc.)
The call center I used to work at had no dress code and no drug tests. In fact, almost everyone who worked there, other than myself, was constantly stoned.
Works now. Thanks!
You're a decade out. Fuel cost was $1.10 - $1.80 / gal

I also like big engines, the dodge had a big block and returned about 7 mpg. Stupid choice in hindsight but that's youth for you.

State parks were an occasional choice - the aim was for at least 50% free camping.

I forget the total amount now, you're probably not far off. If I had sold the camper at the end, it would have been better financially. I didn't have the time, there was no Craigslist then, and I was starting a new job so the cash wasn't going to be an issue.

The average las Vegas trip covers a lot of ground. It's a rhetorical flourish, yes.
One would hope that even average developers for a payments company would have a better understanding of security than to make mistakes like this...
Wearable device detects stress based on autonomic nervous system
> The difference between reversing a string and pulling data from a database are, literally, completely different tasks. The killer is that the latter is something that a candidate will do in a job.

Why can't you do both? Seriously? Pulling data from a database is orders of magnitude harder to get right than reversing a string.
Ah, I see you did let them know and the vulnerability was fixed before you posted. Good. I recommend saying such a thing in your post because it helps people like me understand that you are in fact responsible about the disclosure.
My dad is 49 and he still works on projects till 11-12 in the night. Ask him and he always says 'I am doing a build, no idea how long will it take'
How to find an email marketing expert?
We have a product that some buyers really like. currently our only marketing approach is to spam to scrapped email addresses. (yes, we are shamed of but it's the most cost effective method we've tested). the good news is that the spam report/complaint ratio is very low, 0.03%. the bad news is the conversion ratio is also very low, under 0.1%. my questions are:
1, will an email marketing export be helpful? will they insist to send legit receivers? will it be an excuse to have horrible result, charge us tons of $$ then leave us struggle?
2, where to find them? any place that we can simply hire and pay without worrying too much about the skill level, profession ethic, etc.?
3, what's the fee level involved? we are willing to pay by performance + small base fee. what's the standard payment scheme?
thanks!
Except you're talking about a payments startup. In startups, engineering talent isn't very important.
> It sounds like it wasn't launched yet. [...] Someone discovered the URL and posted it to Hacker News.

Sorry, but if you put a public site on the Internet, somewhere it can be discovered, and you are prompting people to put in sensitive credentials on that site, then you have launched for practical purposes. You should be implementing security measures accordingly.

If you're not ready for that and just want to show friends, it's not exactly rocket science to add basic HTTP Auth to the site, lock it to specific IP addresses, or any number of other trivial measures that would have prevented this problem.
What do you mean by "backups encrypted on the client?"
I've never tried living like this, but we had a similar VW camper van that was our main car and also our holiday accommodation.

One thing to remember - when you stop in a layby for the night, you will get on average 2-3 people think it is HILARIOUS to drive past with hand on their car horn.
"The user ID in the URL like this is a giant "try editing me and see what happens" sign"

What's really surprising is that apparently the dev on this never viewed any porn on the internet.
This is a rare instance where Jeff is wrong.

There is a big difference between knowing your priorities (which Jeff describes) and knowing all the little things that need to be done or will cause problems later (what Jeff misses).

I find it very important to have the To Do lists to keep track of all the little promises and expectations. Many of the great leaders I've worked with have done similar. Those that don't have someone else keeping track of their commitments.

Certain creative jobs can be isolated, but jobs that require interacting with others require keeping track of all the details.
Q: am I the only one tired of articles about "Goodbye ..."
People do startups, get some traction, then write about how they are moving on, technology wise. Why bash the stack that got them started? Why not show some appreciation, then move on?
How a Fox, a Chicken, a Teacher and a Lame VP Made Me A Programmer
Fair enough, but Kolmogorov randomness is an existence concept, not a constructive concept, so I find it weird to talk about having such a string in this case where a real person sets about to generate a concrete file.

Can you generate a Kolmogorov random file on your particular Unix system? That requires specifying what "your Unix system" rather rigorously, which seems unpleasant.
Holy shit! I consider myself a mediocre programmer at best and even I wouldn't make such a dumb mistake. This is literally something only a amateur would do. I'm just awe struck that this would even happen. How?
I actually got a lower GPA in college than I could have because of test anxiety issues in college, and I've since learned that it is hardly a rare condition.
Since you presented 2 possibilities here, neither of which are accurate, what is your response to the reality of the situation?
Skimmed the site and saw:

"FOR THE WEB, BY THE WEB"

"Brackets is built using HTML, CSS and JavaScript. If you can code in Brackets, you can code on Brackets."

"WORKS WITH YOUR BROWSER"

Spent 5 seconds skimming the page up and down for a "Try It" or "Get Started" link, but only found "Check It Out". After 3 seconds of reading, I re-interpreted "Check-Out" as in the source code sense. Re-scanned the page, no other obvious demo headings, so I closed the tab.

Despite the page's high level of visual polish, it completely failed at explaining to me what the app was and how I should go about getting it.
"Never give your information to a business that made a mistake like this, ever."

Fwiw back in 1996 or 97 the UPS website did the same thing. By altering the tracking number you could see somewhat complete information on someone else's shipment. Since the tracking numbers ran in sequence from the shippers log books giving one tracking number from a competitor you could see all their customers. (To get that all you had to do was place a single order so they shipped to you. Although I guess it wouldn't have been even easier to social engineer someone to simply give you any tracking number and save that step.)
Came here to say something similar. Basically you don't need a 'call to action' to fight a bad patent, you just need to ask for it to be re-examined [1]. Now you may be more successful if you have a patent litigator doing the requesting and explaining it to the PTO but it doesn't require much more than patience and a postage stamp to kick the process off.

[1] http://igdmlgd.blogspot.com/2005/11/amazon-one-click-reexami...
Given the severity of the hole, I am thankful that you posted what you did
Larry the Software Guy: Will programming ever be considered "blue collar"?
Friends are customers, too. One row in your database is a customer.

Before ever putting a service up on the public Internet (service defined here as "accepts arbitrary requests" and "delivers arbitrary responses"), I would hope every human being that knows his way around a text editor treats user data like the Dead Sea Scrolls. If you store a row in a database, you then think of every way that an unauthorized party can gain access to that row and close each in multiple ways. I can recite dozens of cases where user data hasn't been treated with the respect it deserves (i.e., every single Bitcoin disclosure due to newer developers running sites that are handling money).

If people took user data more seriously than they do in general, we'd have a lot less leaks. Imagine if this had gone undiscovered and the service took off? Imagine how many undiscovered vulnerabilities there are in there, with this track record to start?

I can't sympathize with this at all. I just can't.
To be honest this is a much better response than the previous on in the other thread.

Also, can you explain what "Glacier is built for durability of 99.999999999%" actually means, if not uptime?
Will this check in both people travelling under the same confirmation number?
Learn Python the fun way
Fair point, though of course that was at a time when most of the world hadn't even heard of the World Wide Web yet. Most people running web sites handling sensitive information have learned a lot of lessons since then.
This is an example of the overuse of the term MVC...
huh? you realize this was a pet project right? we're two dudes with no jobs.
Stopped right here: "Why do outmoded keys, like ESC, persist?"

Why not ask "why do we even sell manual transmission cars?"
The One world schoolhouse by Sal Khan is now available
For example if you find lots of People driving in a consistent manner on what is not already a road on your map then it needs to become one. You can do this ordered by number the number of people per unmapped road segment to have the most effect.

Another example, if you find that everyone drives off the road in a certain area then comes back on a little farther down and that no one drives the intervening segment, then the road probably needs to be adjusted.
Pull requests welcome :)

The OpenPhoto Project is what you're looking for. Open source, installable and offered as a hosted service.

Hosted version: https://openphoto.me

Project page: http://theopenphotoproject.org

Source: https://github.com/photo
This Google Talk starting about 32:35 the author talks a little about SQLite testing:
http://www.youtube.com/watch?v=f428dSRkTs4
Same here haha. I'd be pretty upset if that was my personal information up and available for all to see, but thankfully that wasn't the case.

How this happened is what I want to know too.
RE: durability:

http://aws.amazon.com/glacier/faqs/#How_durable_is_Amazon_Gl...
don't confuse the URL structure with the application design. just because the url is /user/87/edit doesn't mean that there is a file called edit inside a folder called 87. almost any modern web development framework lets you create whatever URLs you want. i'm sure, internally, that every user's edit panel is powered by the same code.
Have a look at The OpenPhoto Project. It's an OpenPhoto photo platform you can sign up to use or install yourself. Works with S3, Dropbox, Box.net, local filesystem or anything else you want to write a little code for.

Hosted version: https://openphoto.me

Project page: http://theopenphotoproject.org

Source: https://github.com/photo
You repeatedly write some form of that assertion (we're two nerds) as if it is supposed to excuse something. I honestly couldn't give a rat's ass regarding who you are. I care about your actions and your actions alone. Stop making excuses!

I'd like you to apologize not only for the disclosure, but also to the reporter for how you treated him in the other thread. The entire other thread of your responses is disgusting, and you don't get to write it off because of your gender, quantity, or employment status. Own your comments and stop excusing them with that bullshit line.

I have to admit that I would also be pleased if your service disappeared until you're working with somebody who has a little more experience with secure Web applications; this mistake betrays your experience. Since we all started somewhere, though, I can only hope you fix this on your own.
Beware the mistake you think you'll never make :)
Have a look at The OpenPhoto Project.

Hosted version: https://openphoto.me

Project page: http://theopenphotoproject.org

Source: https://github.com/photo
More evidence that Voyager has exited the solar system
Have a look at The OpenPhoto Project

Hosted version: https://openphoto.me

Project page: http://theopenphotoproject.org

Source: https://github.com/photo
Well that's not a very helpful attitude. People should be instructive rather than discourage someone from pursuing a reasonable project.
still... developing an application and then bolting on some security over top of it later seems like a recipe for disaster. And pushing it to a public server before any security has been implemented is a very stupid thing to do.
I'm used to the NFC in Japan since like 2006

1. Get out phone

2. Tap phone on sensor

The end.

The NFC system in Japan (standard on nearly all phones except iPhone) works by putting virtual cash into some chip that doesn't need the phone. In fact you can do it with your train pass which was the first way they did it and then later added the same chip to the phone's case.

So, no need to turn on the phone or choose an app. To add cash to the chip there is an app so basically you add $50-$200 and then don't worry about it for a week or month.

Since they started as train passes you can also rid all the trains, subways and buses (take a out phone, tap on sensor, done).

You can even reserve seats for long distance trains on your phone, walk on the train, there's a sensor above the seat you tap to "check in". Tap it again to check out if you want to switch seats.

The chip holds all the transactions on it. My 2006 Sony Vaio has a reader built in for the chip which can import that transactions for things like expense reports. I would guess that more current phones have apps for reading the chip.
Remind me again why anybody is still using Linode ?

Poor uptime and a disgraceful attitude towards security. ANY service provider that hides the facts behind major security incidents from their customers should never be used.

I guess their new customers will soon realise how crappy it feels to find out from Reddit that your VPS is potentially hacked.
thanks for this tip I never realized this. More in the link if interested

http://unix.stackexchange.com/questions/16564/why-are-the-fi...
A year ahead of you :). Pull requests!

Hosted version: https://openphoto.me

Project page: http://theopenphotoproject.org

Source: https://github.com/photo
It's not helpful, it's realistic. My exact wording was "your time will be better spent elsewhere."

We each have 24 hours in a day. I spend 8-9 of mine sleeping, 9-10 at work. That doesn't leave much leftover for me.

If zacharyvoase wants to spend his precious free time educating people who haven't done any due diligence to learn how to build a secure web app, that's his prerogative. But I don't see it as a good use of his time - there's already tons of resources out there that will do a better job than zachary. Is HN supposed to be a newbie education destination?
Louis C.K. is selling another comedian's standup on his site for $5
There is a huge market for data that needs to be retained indefinitely, or for some long period of time. Oftentimes this is related to compliance. The frequency that the data is accessed is incredibly small -- or even zero.

For example, in several states, all records relating to a minor in state custody, an adoption, or receiving certain nbenefits must be kept for 26 years after the minor turns 18. Today, states are either storing this data on tape, or paying some government contractor to do it for them -- at an expense several times that of Glacier.

Another example is litigation holds. One former employer was forced to hold around a petabyte of data 7 years for a complex civil suit, because... A judge said so. In that case, the high cost of retrieval may be a benefit, because the plaintiff would be footing the bill.
We've recently done a redesign for a site at $work, but it's not using any sort of framework like Bootstrap or Foundation. Is it possible to add in Bootstrap after the fact? I would kill to have all the various UI elements available to me, but throwing everything out and starting over after a month is not an option.
Comparing GM, Ford, and Chrysler all going bankrupt simultaneously in the middle of credit crisis is not comparable to when individual airlines go bankrupt due to poor management. The auto industry is highly concentrated in a single geographic area and are all economically dependent upon one another due to shared suppliers. It's very likely that if GM or Chrysler went bankrupt Ford would too. Who would be left then to use these assets? Some unnamed US automotive company? A Japanese automotive company? (imagine how that would go over.) Just how long do you think it would have taken for Detroit to get back to work? A month? 6 months? A year? A decade? Don't forget that if Detroit went bankrupt and turned into a dust bowl, aside from the untold amounts of human suffering it would drag down GDP and have wide-ranging effects on the rest of the country.
OK, I RSVPed - ping me - contact info in my profile - doing some simple mad science experiments around doing a social aggregator for financial market news, so far it's sort of a semi-useful mashup of YC and TechMeme. Maybe grab drinks in NY the Wednesday or Thursday before heading out? or maybe meet up out there!
citation or proof of claims ?
Javascript's Future: Generators
Ah I'm reminded of the Blippy credit card leak http://venturebeat.com/2010/04/23/blippy-credit-card-citiban...

What strange times we live in.
OK, I RSVPed - ping me - contact info in my profile - doing some simple mad science experiments around doing a social aggregator for financial market news, so far it's sort of a semi-useful mashup of YC and TechMeme. Maybe grab drinks in NY the Wednesday or Thursday before heading out? or maybe meet up out there!

When we set a date can announce for any other folks from NY.
Who would you suggest then instead of Linode? I was thinking of renting their smallest one to have something to fart around with.
Intel & Ultrabook are sponsors for the feed
> only because you claimed, like so many others here do, that all that matters are facts not "authority"

I ... never ... said .. any ... such ... thing.

Circle the words on the screen in front of you, where I ever uttered these words, anywhere, on God's green Earth.

You need to start reading what people say, not what your overactive imagination believes they said.

> ... seems to also imply you view this as a debate instead of a discussion ...

When someone invents a position to conveniently argue against, of course it's a debate -- a debate between fantasy and reality.

Notice how I have in each and every case replied directly to your words, which I quote in full. Notice how you don't have time to check in with reality before ascending your soapbox.
People who want to be coding at all should follow this advice.

An easy way to turbocharge a team of hot-shot young developers is as follows: Tell them to not come in over the weekend (unless there is a seriously important deadline that cannot be handled any other way, and this has been discussed with the team). Tell them to go home in time to be able to go out to dinner or catch a movie (tricky, because odds are good that they are coming in to work late, and we do want everyone doing roughly 8 hour days, five days a week). Tell them to spend less time coding and more time planning.

It can take a few weeks for the improvements to materialize, but overall productivity will go up. Code quality will go up. Energy and enthusiasm will go up. Once you see these upticks, you can work on all the other things that the team needs to do to improve their code.

And then when the shit hits the fan and you do need to push the team, there will be room to push them. They will have energy reserves they can draw on. They will have trust in you as a manager. They will be able to draw on that extra 10%.

Marathon coding is a great way to deliver a terrible product that is hard to maintain
I think it's at an entirely different level when it's a brand new company and a trivial security flaw. That just seems like incompetence, and he's absolutely right to suggest not trusting people like that with your data.
http://arstechnica.com/business/2012/03/bitcoins-worth-22800...
Ugh. Seriously?

How did you not notice that?
That is completely wrong.

In order for your plan to work, you'd need said car to increase in value more than the combined amount of:
- taxes paid
- storage costs
- service costs
- insurance costs
- interest costs on the loan

The car would have to do what 99.9999% of all cars on the planet fail to do - increase in value once it was purchased.

Now, if you live in a high inflation country, then the car may nominally increase in value more than the loan - but you're still losing money. You wouldn't be able to, say, swap the used car for a new one, so it's not really worth more.

>I did the math and you wouldn't be getting all of your money back; but at the end you made a profit and you did get to drive a rather expensive car.

If you didn't get your money back, by definition you didn't make a profit. You made a loss. A profit would be where you got all of your original capital back, and then some extra after all the expenses paid.

It just doesn't happen. Especially with brand new supercars.
Bartender – Organize your Menu Bar Apps
Racism or Bullying - either way props to the boss for firing 4 people over it. If you leave that unchecked, it destroys a corporate culture.
Ironically that command is used to set the hostname but not read it.

Next you'll tell me you don't even know what `uname` does!
even if you get shutdon you've inspired me to write a script to do it myself. any chance you would publish your code if you were shutdown?
I ask because that's my basic understanding of what happened in the aftermath of the 2008 crash in the US.

It seems trillions of dollars were printed with very little negative impact. How can that be?
Hopefully 20 years from now things will be better.
Facilities rounds them up from time to time. Apparently at B43 right after TGIF, forcing me to walk back to GWC.

In general, there are usually plenty of bikes around campus, though more at the inner buildings and fewer at the outer buildings.
Exactly. And this I hadn't seen:

We make the tools and services that allow people to feel human

We need tools and services to feel human? I know it's marketing speak but geez.
Yea, it would be a workaround, not a fix.
مباراة الاهلي وصن شاين بث مباشر
Prgrmr.com
Another hole that has been exploited in the past (speaking generally here, not about this specific startup) is a password reset function that confirms the email address it is sending the password/recovery link to. If the accounts are sequentially numbered, it's a trivial exercise to fetch a reset link for each member, and scrape the email address returned.
A contract worker with a luxury of selecting which client's projects to work on and get paid $125/hour. You realize your are the 1%. The 99% have more constraints and hardships.
AAPKE KHAT | WEEKLY AKHBAR-E-JEHAN, KARACHI | WEEKLY URDU MAGAZINE
Free Articles for Seo and Marketing- Free Download
Is this a joke? Looks like a malware site.
Why is there a ?hn link referral tag at the end of the URL?
Legally, they're now required by law to disclose to their users of a security breach: http://en.wikipedia.org/wiki/Security_breach_notification_la...

Since whomever discovered the bug was able to access others' sensitive information, they have to disclose.
Yea, this is the right solution!